Algorithms for CRT-variant of Approximate Greatest Common Divisor Problem

Abstract

The approximate greatest common divisor problem (ACD) and its variants have been used to construct many cryptographic primitives. In particular, the variants of the ACD problem based on Chinese remainder theorem (CRT) are being used in the constructions of a batch fully homomorphic encryption to encrypt multiple messages in one ciphertext. Despite the utility of the CRT-variant scheme, the algorithms that secures its security foundation have not been probed well enough.In this paper, we propose two algorithms and the results of experiments in which the proposed algorithms were used to solve the variant problem. Both algorithms take the same time complexity $\begin{array}{} \displaystyle 2^{\tilde{O}(\frac{\gamma}{(\eta-\rho)^2})} \end{array}$ up to a polynomial factor to solve the variant problem for the bit size of samples γ, secret primes η, and error bound ρ. Our algorithm gives the first parameter condition related to η and γ size. From the results of the experiments, it has been proved that the proposed algorithms work well both in theoretical and experimental terms.

Extension of simultaneous Diophantine approximation algorithm for partial approximate common divisor variants

“…Because the size of c is unknown, the algorithm in [21] is not directly applicable to the given modified samples. Thus, we consider an analogous technique in Section 3.1.…”

“…To apply the method similarly to the algorithm in [21], we define a new auxiliary input d of the form for scaled CCK‐ACD. We here note that the auxiliary input has no term of .…”

“…Because the SDA algorithm was only proposed for solving the PACD problem, analysing variant problems emerged as follow-up research. Recently, Cheon et al first suggest an extended SDA algorithm to solve the CCK-ACD problem [21] under the condition n ⋅ ð 2logβ β−1 þ 1Þ ¼ OðηÞ. However, to date, extending the SDA algorithm to solve the other variants is not clearly established.…”

“…Our algorithms employ lattice reduction algorithms such as the BKZ algorithm to obtain a short vector generated by multiple instances of the target problems, and the short vector obtained is used to reconstruct algebraic relations for recovering secret primes, similar to previous approaches [21–23]. Asymptotically, we can find all prime factors of CRT‐ACD and scaled CRT‐ACD under the condition .…”

“…Recently, Cheon et al. first suggest an extended SDA algorithm to solve the CCK‐ACD problem [21] under the condition . However, to date, extending the SDA algorithm to solve the other variants is not clearly established.…”